Strange issue - not sure how to fix

pfguy2018

That is strange. Because I am having no trouble accessing any other sites, including sites where I have never browsed before.

How do I solve that issue? Any pointers?

johnpoz

Well why can you not query the roots... Try to query one..

[2.4.4-RELEASE][admin@sg4860.local.lan]/root: dig @h.root-servers.net com NS

; <<>> DiG 9.12.2-P1 <<>> @h.root-servers.net com NS
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54900
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;com.                           IN      NS

;; AUTHORITY SECTION:
com.                    172800  IN      NS      a.gtld-servers.net.
com.                    172800  IN      NS      b.gtld-servers.net.
com.                    172800  IN      NS      c.gtld-servers.net.
com.                    172800  IN      NS      d.gtld-servers.net.
com.                    172800  IN      NS      e.gtld-servers.net.
com.                    172800  IN      NS      f.gtld-servers.net.
com.                    172800  IN      NS      g.gtld-servers.net.
com.                    172800  IN      NS      h.gtld-servers.net.
com.                    172800  IN      NS      i.gtld-servers.net.
com.                    172800  IN      NS      j.gtld-servers.net.
com.                    172800  IN      NS      k.gtld-servers.net.
com.                    172800  IN      NS      l.gtld-servers.net.
com.                    172800  IN      NS      m.gtld-servers.net.

;; ADDITIONAL SECTION:
a.gtld-servers.net.     172800  IN      A       192.5.6.30
b.gtld-servers.net.     172800  IN      A       192.33.14.30
c.gtld-servers.net.     172800  IN      A       192.26.92.30
d.gtld-servers.net.     172800  IN      A       192.31.80.30
e.gtld-servers.net.     172800  IN      A       192.12.94.30
f.gtld-servers.net.     172800  IN      A       192.35.51.30
g.gtld-servers.net.     172800  IN      A       192.42.93.30
h.gtld-servers.net.     172800  IN      A       192.54.112.30
i.gtld-servers.net.     172800  IN      A       192.43.172.30
j.gtld-servers.net.     172800  IN      A       192.48.79.30
k.gtld-servers.net.     172800  IN      A       192.52.178.30
l.gtld-servers.net.     172800  IN      A       192.41.162.30
m.gtld-servers.net.     172800  IN      A       192.55.83.30
a.gtld-servers.net.     172800  IN      AAAA    2001:503:a83e::2:30
b.gtld-servers.net.     172800  IN      AAAA    2001:503:231d::2:30
c.gtld-servers.net.     172800  IN      AAAA    2001:503:83eb::30
d.gtld-servers.net.     172800  IN      AAAA    2001:500:856e::30
e.gtld-servers.net.     172800  IN      AAAA    2001:502:1ca1::30
f.gtld-servers.net.     172800  IN      AAAA    2001:503:d414::30
g.gtld-servers.net.     172800  IN      AAAA    2001:503:eea3::30
h.gtld-servers.net.     172800  IN      AAAA    2001:502:8cc::30
i.gtld-servers.net.     172800  IN      AAAA    2001:503:39c1::30
j.gtld-servers.net.     172800  IN      AAAA    2001:502:7094::30
k.gtld-servers.net.     172800  IN      AAAA    2001:503:d2d::30
l.gtld-servers.net.     172800  IN      AAAA    2001:500:d937::30
m.gtld-servers.net.     172800  IN      AAAA    2001:501:b1f9::30

;; Query time: 45 msec
;; SERVER: 198.97.190.53#53(198.97.190.53)
;; WHEN: Sat Feb 22 16:49:09 CST 2020

pfguy2018

@johnpoz said in Strange issue - not sure how to fix:

dig @h.root-servers.net com NS

; <<>> DiG 9.12.2-P1 <<>> @h.root-servers.net com NS
; (2 servers found)
;; global options: +cmd
;; connection timed out; no servers could be reached

johnpoz

your not even getting an IP? dig to IP.

[2.4.4-RELEASE][admin@sg4860.local.lan]/root: dig h.root-servers.net 

; <<>> DiG 9.12.2-P1 <<>> h.root-servers.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31354
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;h.root-servers.net.            IN      A

;; ANSWER SECTION:
h.root-servers.net.     85798   IN      A       198.97.190.53

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Feb 22 16:51:18 CST 2020
;; MSG SIZE  rcvd: 63

Then try and dig to that IP..

dig @198.97.190.53 com ns

If your not getting back IPs from unbound for roots - then yeah your going to have all kinds of issues!! You would only be able to resolve stuff that you have IPs to be able to ask those NS.

pfguy2018

@johnpoz said in Strange issue - not sure how to fix:

dig h.root-servers.net

I just rebooted, so I am able to access feedly.com again. But who knows for how long?

This is the output:
; <<>> DiG 9.12.2-P1 <<>> h.root-servers.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8969
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;h.root-servers.net. IN A

;; ANSWER SECTION:
h.root-servers.net. 86400 IN A 198.97.190.53

;; Query time: 3199 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Feb 22 17:57:27 EST 2020
;; MSG SIZE rcvd: 63

; <<>> DiG 9.12.2-P1 <<>> @198.97.190.53 com ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49732
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;com. IN NS

;; AUTHORITY SECTION:
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.

;; ADDITIONAL SECTION:
a.gtld-servers.net. 172800 IN A 192.5.6.30
b.gtld-servers.net. 172800 IN A 192.33.14.30
c.gtld-servers.net. 172800 IN A 192.26.92.30
d.gtld-servers.net. 172800 IN A 192.31.80.30
e.gtld-servers.net. 172800 IN A 192.12.94.30
f.gtld-servers.net. 172800 IN A 192.35.51.30
g.gtld-servers.net. 172800 IN A 192.42.93.30
h.gtld-servers.net. 172800 IN A 192.54.112.30
i.gtld-servers.net. 172800 IN A 192.43.172.30
j.gtld-servers.net. 172800 IN A 192.48.79.30
k.gtld-servers.net. 172800 IN A 192.52.178.30
l.gtld-servers.net. 172800 IN A 192.41.162.30
m.gtld-servers.net. 172800 IN A 192.55.83.30
a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30
b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30
c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30
d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30
e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30
f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30
g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30
h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30
i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30
j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30
k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30
l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30
m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30

;; Query time: 27 msec
;; SERVER: 198.97.190.53#53(198.97.190.53)
;; WHEN: Sat Feb 22 17:57:53 EST 2020
;; MSG SIZE rcvd: 828

Does it matter that my DNS is set to 127.0.0.1?

johnpoz

That was after you rebooted.. Or was that before you rebooted... You shouldn't have to reboot - just restart unbound.

johnpoz

if you are resolving - then yes your dns should be set to loopback! That is unbound directly..

pfguy2018

This was after I rebooted. Prior to that, I did in fact restart unbound manually, but it did not fix the problem. Rebooting always solves this issue, for some length of time, but then it always recurs

It occurs to me that the reason I can access sites in the browser that I have never accessed before even when I am experiencing this issue is that I am using Firefox, which internally sets its own DNS to cloudfare DNS. So it is probably bypassing the pfSense DNS and allowing me to access these sites. So it was masking the issue. Strangely though, it was still not allowing me to access feedly.com. So something is still being blocked somewhere at some point.

pfguy2018

Other than rebooting, is there anything else I can try to get Unbound connected to the root servers when this occurs again?

johnpoz

@pfguy2018 said in Strange issue - not sure how to fix:

which internally sets its own DNS to cloudfare DNS

Mine doesn't - I have that shit turned off!! F that going to hand everything to cloudflare..

I would validate the query is actually going out, or not... Do a sniff on your wan - are you seeing dns going out.. Up the logging of unbound to see if you can see errors, etc.

If your saying restarting unbound doesn't fix it but reboot, then points to something with the connection... Sniff to see if your dns goes out and your just not getting an answer.

pfguy2018

I don't see any errors in the unbound log at level 2 or 3 logging. I am not sure how to sniff the WAN traffic - can you point me to some instructions for how to do that?

johnpoz

Go to diag menu, packet capture - pick your wan interface.

pfguy2018

Doing that, how do I check if the root servers are being queried?

johnpoz

Well query something ;) While your sniffing..

pfguy2018

OK, now I just have to wait for the DNS resolution to start failing again before I sniff the traffic. Will report back later.

johnpoz

You sniff now right to get a feel for what sort of traffic you see, etc. When its working...

You might want to grab say wireshark for your pc, so you can load the capture into that - download on the diag page.. This will give you way more insight and details of what is going on.. But really your just wanting to see that hey the query went out.. Did you or did you not get an answer..

What you were showing you were having timeouts..

pfguy2018

I am trying to post the traffic output, but it is being flagged as spam by the software running the forum, and I can't post it.

pfguy2018

08:57:57.060415 ARP, Request who-has 99.228.243.128 tell 99.228.242.1, length 46
08:57:57.071807 IP xxx.xxx.xxx.xxx > 99.228.144.1: ICMP echo request, id 42349, seq 6292, length 8
08:57:57.082227 IP 99.228.144.1 > xxx.xxx.xxx.xxx: ICMP echo reply, id 42349, seq 6292, length 8
08:57:57.084566 IP xxx.xxx.xxx.xxx.23495 > 24.156.130.43.80: tcp 442
08:57:57.092988 IP 24.156.130.43.80 > xxx.xxx.xxx.xxx.23495: tcp 0
08:57:57.097414 ARP, Request who-has 206.188.75.254 tell 206.188.75.225, length 46
08:57:57.100039 IP 24.156.130.43.80 > xxx.xxx.xxx.xxx.23495: tcp 1448
08:57:57.100058 IP 24.156.130.43.80 > xxx.xxx.xxx.xxx.23495: tcp 572
08:57:57.101500 IP xxx.xxx.xxx.xxx.23495 > 24.156.130.43.80: tcp 0
08:57:57.115341 ARP, Request who-has 99.228.195.183 tell 99.228.194.1, length 46
08:57:57.132347 ARP, Request who-has 209.142.43.80 tell 209.142.43.65, length 46
08:57:57.136346 ARP, Request who-has 104.158.199.48 tell 104.158.199.33, length 46
08:57:57.153353 ARP, Request who-has 72.53.212.137 tell 72.53.212.129, length 46
08:57:57.155347 ARP, Request who-has 99.228.150.0 tell 99.228.150.1, length 46
08:57:57.157348 ARP, Request who-has 135.23.223.90 tell 135.23.223.65, length 46
08:57:57.176453 ARP, Request who-has 108.168.98.253 tell 108.168.98.225, length 46
08:57:57.183379 ARP, Request who-has 99.228.197.247 tell 99.228.196.1, length 46
08:57:57.189359 ARP, Request who-has 99.228.237.142 tell 99.228.236.1, length 46
08:57:57.190311 IP xxx.xxx.xxx.xxx.24725 > 151.101.126.99.443: tcp 111
08:57:57.192357 ARP, Request who-has 99.228.237.217 tell 99.228.236.1, length 46
08:57:57.202537 IP 151.101.126.99.443 > xxx.xxx.xxx.xxx.24725: tcp 1448
08:57:57.202631 IP 151.101.126.99.443 > xxx.xxx.xxx.xxx.24725: tcp 1340
08:57:57.202682 IP 151.101.126.99.443 > xxx.xxx.xxx.xxx.24725: tcp 1448
08:57:57.202876 IP 151.101.126.99.443 > xxx.xxx.xxx.xxx.24725: tcp 1340

pfguy2018

I was able to post part of it above. Not sure if it contains any useful info.

johnpoz

None of that is dns... Port 53 is dns..

This is dns traffic

08:51:11.915816 IP 64.53.xxx.xxx.1499 > 204.13.251.3.53: UDP, length 47
08:51:11.916510 IP 64.53.xxx.xxx.24691 > 208.78.71.3.53: UDP, length 47
08:51:11.918974 IP 64.53.xxx.xxx.63171 > 208.80.125.4.53: UDP, length 46
08:51:11.919863 IP 64.53.xxx.xxx.29586 > 208.80.126.4.53: UDP, length 46
08:51:11.943785 IP 208.80.126.4.53 > 64.53.xxx.xxx.29586: UDP, length 92
08:51:11.944094 IP 64.53.xxx.xxx.26752 > 192.229.254.5.53: UDP, length 47
08:51:11.945081 IP 208.80.125.4.53 > 64.53.xxx.xxx.63171: UDP, length 95
08:51:11.945275 IP 64.53.xxx.xxx.34945 > 72.21.80.6.53: UDP, length 47
08:51:11.945456 IP 208.78.71.3.53 > 64.53.xxx.xxx.24691: UDP, length 116
08:51:11.945733 IP 64.53.xxx.xxx.29783 > 208.80.125.4.53: UDP, length 46
08:51:11.959085 IP 204.13.251.3.53 > 64.53.xxx.xxx.1499: UDP, length 116
08:51:11.959591 IP 64.53.xxx.xxx.2756 > 208.80.125.4.53: UDP, length 46
08:51:11.963659 IP 192.229.254.5.53 > 64.53.xxx.xxx.26752: UDP, length 63
08:51:11.963870 IP 64.53.xxx.xxx.11652 > 192.229.254.6.53: UDP, length 47
08:51:11.969938 IP 208.80.125.4.53 > 64.53.xxx.xxx.29783: UDP, length 95
08:51:11.970255 IP 64.53.xxx.xxx.42952 > 192.229.254.6.53: UDP, length 47
08:51:11.971483 IP 72.21.80.6.53 > 64.53.xxx.xxx.34945: UDP, length 63
08:51:11.971721 IP 64.53.xxx.xxx.23430 > 72.21.80.6.53: UDP, length 47
08:51:11.976236 IP 208.80.125.4.53 > 64.53.xxx.xxx.2756: UDP, length 95
08:51:11.976409 IP 64.53.xxx.xxx.57024 > 72.21.80.5.53: UDP, length 47
08:51:11.977384 IP 192.229.254.6.53 > 64.53.xxx.xxx.11652: UDP, length 63

And if open in wireshark I can see info..